Hi,
I'm trying to configure remote access via a IPSec VPN with XAuth. The *relevant* lines of the config are below:
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
lifetime 28800
!
crypto isakmp client configuration group VPNCLIENTS
key <removed>
dns <REMOVED>
pool VPNPOOL
max-users 5
crypto isakmp profile VPNCLIENT
match identity group <REMOVED>
client authentication list VPNAUTHENLIST
isakmp authorization list VPNAUTHORLIST
client configuration address respond
virtual-template 2
!
crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac
mode tunnel
crypto ipsec df-bit clear
!
crypto ipsec profile VPNTRANSFORM
set transform-set AES256-SHA
!
interface Loopback0
ip address 192.168.202.1 255.255.255.248
!
interface Virtual-Template2 type tunnel
ip unnumbered Loopback0
ip nat inside
ip inspect FWOUT in
ip virtual-reassembly in
tunnel mode ipsec ipv4
tunnel protection ipsec profile VPNTRANSFORM
!
interface Dialer0
ip access-group internet_in in
ip access-group internet_out out
ip inspect FWOUT out
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip local pool VPNPOOL 192.168.202.2 192.168.202.6
!
ip nat inside source list NATACL interface Dialer0 overload
!
ip access-list extended NATACL
permit ip 192.168.202.0 0.0.0.7 any
<END CONFIG>
I can authenticate with the VPN, and access internal hosts without issue - I'm trying to configure a "full" tunnel. Please note, we run non-RFC1918, public addresses internally, the NAT config above has been added just for the VPN cients. The probem is I can't access the Internet across the VPN. Looking at the nat translation table, there are entries being created, though it seems the router is dropping return traffic - e.g. if I do a term mon, I can see port 53 DNS packets and port 80 web traffic being dropped inbound when destined for the dialer 0 interface IP. I was expecting the "ip inspect" lines to permit the nat'd traffic?
To me, it looks like the "ip inspect" is adding sessions for the pre-nat 192.168.202 addresses, not the router's external interface.
Any help you can give would be most appreciated.
